namespace ZB.MOM.WW.Auth.ApiKeys;

/// <summary>
/// Resolves the secret pepper used to verify API-key secret hashes.
/// </summary>
/// <remarks>
/// Implementations resolve the pepper from a configured secret source. A concrete,
/// configuration-backed provider is wired up separately; this abstraction lets the
/// verifier fail closed when the pepper cannot be resolved.
/// </remarks>
public interface IApiKeyPepperProvider
{
    /// <summary>
    /// Returns the resolved pepper, or <c>null</c>/empty if it is currently unavailable.
    /// </summary>
    /// <returns>The pepper value, or <c>null</c>/whitespace when unavailable.</returns>
    string? GetPepper();
}
